Check if the password changed when user is not null

louislam · Oct 21, 2023 · 87b2e45 · 87b2e45
1 parent 9b599cc
commit 87b2e45
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/server/server.js b/server/server.js
@@ -318,12 +318,12 @@ let needSetup = false;
                     decoded.username,
                 ]);
 
-                // Check if the password changed
-                if (decoded.h !== shake256(user.password, SHAKE256_LENGTH)) {
-                    throw new Error("The token is invalid due to password change or old token");
-                }
-
                 if (user) {
+                    // Check if the password changed
+                    if (decoded.h !== shake256(user.password, SHAKE256_LENGTH)) {
+                        throw new Error("The token is invalid due to password change or old token");
+                    }
+
                     log.debug("auth", "afterLogin");
                     afterLogin(socket, user);
                     log.debug("auth", "afterLogin ok");